Table Of ContentWEB
Z
Information Technology W
h
a
u
In late 2013, approximately 40 million customer debit and credit cards were leaked in a data o
breach at Target. This catastrophic event, deemed one of the biggest data breaches ever,
clearly showed that many companies need to significantly improve their information secu-
SECURIT Y
rity strategies. Web Security: A White Hat Perspective presents a comprehensive guide W
to web security technology and explains how companies can build a highly effective and
sustainable security system.
E
In this book, web security expert Hanqing Wu reveals how hackers work and explains why
companies of different scale require different security methodologies. With in-depth analysis A WhiteHat Perspective
of the reasons behind the choices, the book covers client script security, server applications B
security, and Internet company security operations. It also includes coverage of browser
security, cross sites script attacks, click jacking, HTML5/PHP security, injection attacks,
authentication, session management, access control, web frame security, DDOS, leaks,
S
Internet transactions security, and the security development lifecycle.
E
Features
• Offers practical solutions to a wide range of web security vulnerabilities and issues
C
• Explains how a website should deal with leaks and how to guarantee the safety of
the site
U
• Covers numerous security development processes and operations issues
• Analyzes the nature of web security and describes how to solve problem on
a practical basis R
• Written by leading web security expert with 13 years of practical experience,
including eight years developing security systems at Alibaba, a world-leading I
e-commerce company
T
Y
6000 Broken Sound Parkway, NW
K20571
Suite 300, Boca Raton, FL 33487
711 Third Avenue Hanqing Wu and Liz Zhao
New York, NY 10017 ISBN: 978-1-4665-9261-2
an informa business
2 Park Square, Milton Park 90000
www.crcpress.com Abingdon, Oxon OX14 4RN, UK
9 781466 592612
w w w . c r c p r e s s . c o m
K20571 cvr mech.indd 1 3/3/15 8:15 AM
WEB
SECURITY
A WhiteHat Perspective
WEB
SECURITY
A WhiteHat Perspective
Hanqing Wu and Liz Zhao
Co-published by Publishing House of Electronics Industry
CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2015 by Taylor & Francis Group, LLC
CRC Press is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Version Date: 20150303
International Standard Book Number-13: 978-1-4665-9262-9 (eBook - PDF)
This book contains information obtained from authentic and highly regarded sources. Reasonable efforts have been made to
publish reliable data and information, but the author and publisher cannot assume responsibility for the validity of all materials
or the consequences of their use. The authors and publishers have attempted to trace the copyright holders of all material repro-
duced in this publication and apologize to copyright holders if permission to publish in this form has not been obtained. If any
copyright material has not been acknowledged please write and let us know so we may rectify in any future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or utilized in any
form by any electronic, mechanical, or other means, now known or hereafter invented, including photocopying, microfilming,
and recording, or in any information storage or retrieval system, without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access www.copyright.com (http://www.copy-
right.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400.
CCC is a not-for-profit organization that provides licenses and registration for a variety of users. For organizations that have been
granted a photocopy license by the CCC, a separate system of payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used only for identifica-
tion and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the CRC Press Web site at
http://www.crcpress.com
Contents
Foreword, xv
Preface, xvii
Authors, xxiii
Section i O ur View of the Security World
chapter 1 ◾ View of the IT Security World 3
1.1 BRIEF HISTORY OF WEB SECURITY 3
1.1.1 Brief History of Chinese Hackers 4
1.1.2 Development Process of Hacking Techniques 4
1.1.3 Rise of Web Security 6
1.2 BLACK HAT, WHITE HAT 7
1.3 BACK TO NATURE: THE ESSENCE OF SECRET SECURITY 8
1.4 SUPERSTITION: THERE IS NO SILVER BULLET 10
1.4.1 Security: An Ongoing Process 10
1.5 SECURITY ELEMENTS 11
1.6 HOW TO IMPLEMENT SAFETY ASSESSMENT 11
1.6.1 Asset Classification 12
1.6.2 Threat Analysis 13
1.6.3 Risk Analysis 14
1.6.4 Design of Security Programs 16
1.7 ART OF WAR FOR WHITE HAT 17
1.7.1 Principle of Secure by Default 17
1.7.1.1 Blacklist, Whitelist 17
1.7.1.2 Principle of Least Privilege 18
v
vi ◾ Contents
1.7.2 Principle of Defense in Depth 19
1.7.3 Principles of Data and Code Separation 20
1.7.4 Unpredictability of the Principles 22
1.8 SUMMARY 23
1.A APPENDIX 23
Section ii S afety on the Client Script
chapter 2 ◾ Security of Browser 29
2.1 SAME-ORIGIN POLICY 29
2.2 SANDBOX BROWSER 34
2.3 MALICIOUS URL INTERCEPT 36
2.4 RAPID DEVELOPMENT OF BROWSER SECURITY 39
2.5 SUMMARY 43
chapter 3 ◾ Cross-Site Scripting Attack 45
3.1 INTRODUCTION 45
3.1.1 First Type: Reflected XSS 47
3.1.2 Second Type: Stored XSS 47
3.1.3 Third Type: DOM-Based XSS 47
3.2 ADVANCED XSS ATTACK 49
3.2.1 Preliminary Study on XSS Pay Load 49
3.2.2 XSS Payload Power 52
3.2.2.1 Structure GET and POST Request 52
3.2.2.2 XSS Phishing 58
3.2.2.3 Identify the User’s Browser 59
3.2.2.4 Identify User-Installed Software 62
3.2.2.5 CSS History Hack 64
3.2.2.6 Get the User’s Real IP Address 68
3.2.3 XSS Attack Platform 70
3.2.3.1 Attack API 70
3.2.3.2 BeEF 71
3.2.3.3 XSS-Proxy 71
Contents ◾ vii
3.2.4 Ultimate Weapon: XSS Worm 71
3.2.4.1 Samy Worm 71
3.2.4.2 Baidu Space Worms 78
3.2.5 Debugging JavaScript 83
3.2.5.1 Firebug 83
3.2.5.2 IE 8 Developer Tools 84
3.2.5.3 Fiddler 85
3.2.5.4 HttpWatch 85
3.2.6 Construction Skills of XSS 85
3.2.6.1 Use Character Encoding 86
3.2.6.2 Bypass the Length Limit 87
3.2.6.3 Using <base> Tags 90
3.2.6.4 Magical Effect of window.name 91
3.2.7 Turning Waste into Treasure: Mission Impossible 93
3.2.7.1 Apache Expect Header XSS 93
3.2.7.2 Anehta Boomerang 95
3.2.8 Easily Overlooked Corner: Flash XSS 97
3.2.9 Really Sleep without Any Anxiety: JavaScript Development
Framework 99
3.2.9.1 Dojo 100
3.2.9.2 YUI 101
3.2.9.3 jQuery 101
3.3 XSS DEFENSE 102
3.3.1 Skillfully Deflecting the Question: HttpOnly 102
3.3.2 Input Checking 106
3.3.3 Output Checking 108
3.3.3.1 Secure Coding Function 108
3.3.3.2 Only Need One Kind of Coding 111
3.3.4 Defense XSS Correctly Designed 112
3.3.4.1 Output in HTML Attributes 113
3.3.4.2 Output in the Event 114
3.3.4.3 Output in CSS 114
3.3.4.4 Output in Address 115
3.3.5 Dealing with Rich Text 116
viii ◾ Contents
3.3.6 Defense DOM-Based XSS 117
3.3.7 See XSS from Another Angle of Risk 122
3.4 SUMMARY 122
chapter 4 ◾ Cross-Site Request Forgery 123
4.1 INTRODUCTION 123
4.2 ADVANCED CSRF 125
4.2.1 Cookie Policy of Browsers 125
4.2.2 Side Effect of P3P Header 128
4.2.3 GET? POST? 131
4.2.4 Flash CSRF 133
4.2.5 CSRF Worm 134
4.3 CSRF DEFENSE 136
4.3.1 Verification Code 136
4.3.2 Referer Check 136
4.3.3 Anti-CSRF Token 136
4.3.3.1 Nature of CSRF 137
4.3.3.2 Token Principles 138
4.4 SUMMARY 140
chapter 5 ◾ Clickjacking 141
5.1 WHAT IS CLICKJACKING? 141
5.2 FLASH CLICKJACKING 144
5.3 IMAGE-COVERING ATTACKS 147
5.4 DRAG HIJACKING AND DATA THEFT 148
5.5 CLICKJACKING 3.0: TAPJACKING 152
5.6 DEFENSE AGAINST CLICKJACKING 154
5.6.1 Frame Busting 154
5.6.2 X-Frame-Options 156
5.7 SUMMARY 156
chapter 6 ◾ HTML5 Securities 157
6.1 NEW TAGS OF HTML5 157
6.1.1 New Tags of XSS 157
6.1.2 iframe Sandbox 158
